Gary Secondino: SciTech

Google Gmail Adds Secure Session Option

Wed, 06 Aug 2008 12:48:34 GMT

Google has plugged one of the biggest security risks associated with using its free hosted Gmail mail service, still in beta after four years. You can now select an option in your account preferences to make every session require an encrypted Web connection. I wrote about a number of Gmail vulnerabilities that researchers had found in "Sidejack Attack Jimmies Open Gmail, Other Services," 2007-08-27.

Gmail requires a secure connection for your login details, regardless of whether or not you start with the secure Gmail site address. However, if you start at the non-secure Gmail site, Google redirects you back to an unencrypted Web connection after login. That's always been a mistake on Google's part because your messages would pass in the clear. The sidejacking attack referenced above also proved that someone could intercept your Google session token and have full access to your Gmail account.

Google explained in its Gmail blog that the service has added a Browser Connection option at the bottom of its Settings > General view that lets you select "Always use https," which is the protocol name for a URL that makes your browser start up a SSL/TLS encrypted connection with a Web server.

The Google blog also noted a link that's now at the bottom of the inbox that provides account activity details, as well as a way to sign out sessions initiated from other machines. In my case, for instance, I see several recent sessions: a browser connection last night from home, and IMAP connections from my iPhone for retrieving recent email automatically. (Google is in the process of rolling this feature out, so it may not appear for you quite yet, as it didn't for Adam Engst).

These two changes improve Gmail's security dramatically. I recommend you turn on the https setting immediately.

Copyright © 2008 Glenn Fleishman. TidBITS is copyright © 2008 TidBITS Publishing Inc. If you're reading this article on a Web site other than TidBITS.com, please let us know, because if it was republished without attribution, by a commercial site, or in modified form, it violates our Creative Commons License.

Bare Bones Software's BBEdit 8.7 -- Latest version offers a
major interface overhaul, new prefs, text clippings, improved
JavaScript, new Ruby/SQL/YAML/Markdown support, code folding.
Over 160 new features in all! <http://www.barebones.com/>.

By glenn@tidbits.com (Glenn Fleishman). [TidBITS: Mac News for the Rest of Us]

MIT Major Discovery will unleash solar power revolution

Fri, 01 Aug 2008 15:23:26 GMT

MIT Professor Daniel G. Nocera has developed a simple method to split water molecules and produce oxygen gas, a discovery that paves the way for large-scale use of solar power. I have two words FREE ELECTRICITY! The world will dramatically change. The USA needs to lead the change.

Do-Ra-Mi-Fa-So-La-Ti-Do

Tue, 22 Jul 2008 12:56:43 GMT

Your Computer As Your Singing Coach.

[Slashdot]

Come On Everybody Do The Protein Synthesis

Sun, 30 Mar 2008 15:12:07 GMT

What do you get when you combine molecular biology, hippie culture, interpretive dance, and Jaberwocky?

My New Years Message

Tue, 02 Jan 2007 12:44:38 GMT

Tomorrow Never Knows: Lyrics, AMG, Wikipedia Whithin You Without You: Lyrics, AMG, Wikipedia

Early Christmas Gift ZFS

Fri, 22 Dec 2006 12:21:49 GMT

OK I know it's a total geek thing but this will make life easier on the administrator and user.

iTunes' Hidden Features

Tue, 14 Nov 2006 17:31:36 GMT

Many users are surprised to learn that you can address many of iTunes' power-user shortcomings, especially those relating to media and metadata management, via AppleScript. But you don't need to know the ways of AppleScript to take advantage of this functionality; that's where Doug's AppleScripts for iTunes comes in. A labor of love put together by Doug Adams (no, not that Doug Adams), this massive resource serves as a comprehensive repository for iTunes-focused AppleScripts[~]currently 416 of them. You read that right: there are currently 416 AppleScripts for iTunes on Doug's site; some written by Doug himself, others submitted by readers. It's the Mac OS X Hints, if you will, of iTunes AppleScripts

Graphing requests with Tamper Data

Mon, 13 Nov 2006 18:32:41 GMT

Tamper Data is an extension for intercepting HTTP requests and modifying them. I have very little interest in this functionality myself, but hidden deep within the extension is the ability to make a graph that shows every component of the page - JavaScript, CSS, images - and when each component started and finished loading.

Security Watch

Sun, 20 Aug 2006 14:13:25 GMT

JavaScript plus AJAX equals trouble. CNET Aug 19 2006 10:01AM GMT [Moreover Technologies - CNET]

Radio Userland SNAFU

Sun, 18 Jun 2006 15:49:35 GMT

From mid March 2006 until now mid June, 2006 every time I tried to publish I kept getting error messages returned so I thought Radio Userland had died. Well as you can see Radio Userland is again publishing. I still like Radio but these inconsistencies have made me look at moving to WordPress. Overall though I feel like backing off blogging for a while. Some personal things have changed me and I have less enthusiasm for the technology. I think I might need a vacation.

Tue, 30 May 2006 02:18:38 GMT

Style Sheets 'Made' Easy. One of the biggest problems many people have with setting up a Web site is creating the cascading style sheets (CSS). If you don't know how to create a style sheet, or don't do it that often, here's an alternative. By Lee Underwood. 0526 [WebReference News]

Tue, 30 May 2006 02:16:56 GMT

How to Fix Web Pages with Active Content. As a result of a recent lawsuit, Microsoft has changed the way that Internet Explorer deals with Active Content. This can be fixed by using JavaScript but it creates extra work. Fortunately, there's another solution, IEWebFix. By Ronald Northrip. 0519 [WebReference News]

Windows Access Control

Thu, 09 Mar 2006 12:27:09 GMT

Schneier on Security A weblog covering security and security technology.

Tue, 21 Feb 2006 03:48:29 GMT

Webmonkey First Look: IE7 Preview. Internet Explorer 7 Beta 2 Preview, the first public release of a new Microsoft browser in ages, gets dissected by the Webmonkeys. [Wired News: Top Stories]

Make Surfin' with Safari Even Better

Thu, 09 Feb 2006 12:38:28 GMT

SafariStand adds a ton of new features to Safari.

Adding RAM - The ultimate Mac tune-up

Thu, 09 Feb 2006 12:30:09 GMT

When it comes to upgrading your Mac, RAM is the easy choice. It[base ']s inexpensive, it[base ']s relatively easy to install, and it can make a noticeable difference. But as a quick visit to just about any Mac forum will tell you, RAM upgrades can also be horrifically frustrating. Here[base ']s how to do it right.

Gold Emits Tuned Light

Sat, 07 Jan 2006 10:52:15 GMT

Gold is prized in chip manufacture for its excellent electrical conductivity, but it also has unusual properties that could give it a role in new optical chips, scientists have discovered. In a typical electronic chip, tiny gold wires link microscopic connecting pads on the silicon wafer to the terminals of the chip packaging. The gold wires are about 50 micrometers in diameter, about half as thick as a human hair, and at that thickness the gold still behaves like the shiny metal we know. A micrometer is one millionth of a meter. If you divide it into rods 2,500 times thinner, though, just 20 nanometers across, the gold glitters in an entirely different way, according to scientists at the U.S. Department of Energy's laboratory in Argonne, Illinois. At the nanometer scale, where distances are measured in billionths of a meter, it's not just optical properties that change: many materials respond differently to variations in temperature, and to the effects of electric and magnet fields, when divided into such nanoparticles. The nanoscale gold rods studied at Argonne National Laboratory emit light when electrons in them are stimulated, and the wavelength of the light depends on the length of the rod used, the scientists found. They tested gold rods with lengths between 70 nm and 300 nm. Being able to control the wavelength of light, and to build light sources of a specific wavelength, is very important in optical communications. The discovery at Argonne could one day allow the fabrication of tuned light sources inside chips, leading to the creation of chips that can switch or route optical signals in fiber networks without having to convert them back to an electronic form first, the scientists said. However, they emphasized that they are only involved in basic research, not the development of products. Researchers at the Nanotechnology and Optical Instrumentation Laboratory in Troyes, France, also participated in the research, which was published Dec. 23 in a paper in Physical Review Letters entitled "Surface Plasmon Characteristics of Tunable Photoluminescence in Single Gold Nanorods." It can be viewed at http://scitation.aip.org/getabs/servlet/GetabsServlet?prog=normal&id=PRLTAO000095000026267405000001&idtype=cvips&gifs=Yes

CES News

Sat, 07 Jan 2006 10:46:01 GMT

Skype, the Internet telephony company bought by eBay last year, announced a Wi-Fi Internet connection deal with Netgear. The Netgear Skype phone, due out later this quarter, is designed to let users make calls on the Internet via Wi-Fi. Skype calls between Skype applications users are free. Pricing was not yet available. Also Skype VoIP software gets call forwarding, more. Skype, the Voice over IP software for the Mac, has been updated to version 1.4. Also Airset, a newish collaborative calendar and contacts application that recently integrated nicely with the Skype API, announced integration with Verizon yesterday. You can now easily access most Airset calendar and contact information from a Verizon cell phone.

Squib becomes real

Sun, 18 Dec 2005 12:12:02 GMT

This is a reminder to myself: see what's going on with this. I've started quite a lot of development projects in my time and many (most?) of them never made it very far. When I set out to replace Radio as my blogging tool I knew, at the back of my mind, there was a chance this would be one of those projects. So it is with a great deal of pleasure that I announce the release of Squib 0.3.0 which, if it cannot be said to be perfect, is at least usable on a day to day basis.

When I started I had a view that this was going to be a one user show. My goals were quirky enough that I didn't think anyone else would be interested in Yet Another Blogging Application. I'm grateful to be wrong as Steve Kirks and Andy Fragen have been invaluable in helping me to test, fix, and document Squib.

At this point in it's development Squib is most likely to be interesting to adventurous users who want to jump ship from Radio Userland and take their weblog with them. Squib can import Radio weblogs directly and supports publishing to Radio Community Server, FTP, and SFTP servers. One major caveat is that it doesn't (and may never) support categories although it almost certain will support multiple weblogs in the next version. [Curiouser and Curiouser!]

[To Talk of Many Things]

Listen to CD's on your computer? Spies are there.

Tue, 15 Nov 2005 12:10:17 GMT

This article at Mark's Sysinternals Blog is about how a Sony copy-protected CD installed a rootkit on his system, and the lengths he had to go to to get the normal functions of his PC back. Summary:

By inserting this Sony CD in his computer, Mark's computer was infected with software that installed hidden processes, modified his CD drivers, and tricked the OS into hiding any directory that started with the sequence $SYS$.
Using the features in this software (commonly called a rootkit), the Sony DRM could monitor how many times it was being played and limit the burning of music contained on the CD to another disc. However, it also makes the listener's computer vulnerable to other infections.
When Mark tried to uninstall the software by deleting it, his CD drive completely stopped working.

Over the line? Sony has obliterated the line. This inverts the argument about P2P networks being hives of spyware, trojans, and viruses. We no longer have to go to P2P networks to infect our computers; they now get infected by music produced by the major labels. As if that wasn't enough: first, Sony's artists, such as Van Zant, whose CD infected Mark's computer, have nothing to gain and everything to lose from this DRM madness. Second, technically Mark is now a criminal for undoing the damage that Sony did to his system, thanks to the anti-circumvention clause of the DMCA. UPDATE: It's much worse than I imagined. Wired - Sony Numbers Add Up to Trouble

More than half a million networks, including military and government sites, were likely infected by copy restriction software distributed by Sony on a handful of its CDs, according to a statistical analysis of domain servers conducted by a well-respected security researcher and confirmed by independent experts on Tuesday.

boingboing-Sony anti-customer technology roundup and time-line

Since Hallowe'en, we've been posting the details about he revelations relating to Sony's DRM systems, which show jaw-dropping contempt for their customers, for copyright law, for fair trading and for the public interest. With all these posts strung out over a couple weeks, I thought it was high time we put together an omnibus post, summing up all the posts to date:

boingboing-Sony's spyware "remover" creates huge security hole

Princeton's Ed Felten and Alex Halderman have published new research into a grave security vulnerability opened up if you run the "uninstaller" that Sony supplies to rid your PC of its malicious rootkit software, which it installs when you insert an audio CD into your PC, as a means of restricting your use of the music on the CD. The new vulnerability is as grave as a security vulnerability can be. If you run the uninstaller, your computer can be utterly compromised by an attacker who can reach it via the Web. Your computer can be made to run any code and surrender your data. It can be enlisted to act as a "zombie" for sending spam or attacking sites that are being shaken down in protection rackets.

In my opinion Sony needs to pay for the problems they've caused. Jail time, perhaps. Stiff fines are OK but you know who pays for that. How about no fines and no time served. Just open up their catalog of digital content to the internet for as many days as their nasty spyware is allow to run free. That sounds fair.

Apple Phone idea

Sun, 10 Jul 2005 19:02:01 GMT

Forbes magazine speculates that Apple will launch a cell phone service along with their forthcoming ApplePhone. I believe Forbes misses the mark. I say it will be a VOIP (voice over IP) broadband phone, camera, iPod combo. Bets anyone?

Firefox, the Browser of the Future?

Wed, 06 Jul 2005 13:07:13 GMT

As developers, the evolution of web browsers is something we're all concerned about. How are they the same? How do they differ? Who's winning the so-called browser war? With these and other questions in mind, we spoke to Chris Hofmann, Director of Engineering of the Mozilla Foundation, and asked him about Firefox and where it's headed. By Scott Clark. 0705 [WebReference News]

Summer Moon Illusion

Wed, 22 Jun 2005 14:11:49 GMT

The lowest-hanging full moon in 18 years is going to play tricks on you this week. Step outside any evening at sunset and look around. You'll see a giant moon rising in the east. It looks like Earth's moon, round and cratered; the Man in the Moon is in his usual place. But something's wrong. This full moon is strangely inflated. It's huge! You've just experienced the Moon Illusion. I saw it myself night before last. Take your honey, it is impressive.

Tue, 21 Jun 2005 13:56:43 GMT

Why RSS and Folksonomies Are Becoming So Big.

The Importance of RSS

[base "]Unfortunately, Google[base ']s well of good data is being poisoned by the likes of comment spammers, trackback spammers and adsense mongers. And while Google, the other search engines and the blog software community have been fighting the good fight with ideas like nofollow, Typekey and stop gapping, I think Google knows that when it comes to blogs, they[base ']re losing the semantic ground. And I think they[base ']ve known this for a long time, because for the last year Google has been resting their hopes on a new medium of information[~]really simple syndication. The technologically capable know it as RSS.
If you think about it, rss feeds are a librarian[base ']s wet dream (and make no mistake that Google is essentially a library, check that mission statement out again). An RSS feed is a blog distilled to its core essence. If you look at the output of an RSS feed in a reader, you[base ']ll see no comments, no trackbacks and (for the most part) no design. It[base ']s the better blog. It[base ']s pure data.
And so RSS feeds provide Google all the goodness of blogs without all the semantic garbage that might come with a system open to users that are not the content provider. RSS feeds provide Google clean data, good data and thanks to wide-spread adoption by companies and the major blog software entities, lots of it[sigma].
[sigma]If RSS is getting face-time at the expense of search, Google has something to worry about. And it makes sense. From personal experience, I know my daily routine to keep up with the information overload doesn[base ']t really involve searching anymore, but subscribing. Thanks to services like Del.icio.us, Technorati and Digg.com, people are spending a lot less time actively searching and more time passively reading what[base ']s being updated in their readers[sigma].
[sigma]In the race to find what deserves face-time, services like Del.icio.us, Technorati and Digg.com in combination with the rapid adoption of web apps like bloglines, newsgator, feedster and kinja are making Google[base ']s search seem very, very slow. And it[base ']s all being accomplished with RSS technology[sigma].
Let me give a concrete example based on our experiences here at Particletree. When we launched this site, we knew that the tutorials and information we were gathering and creating were good[~]that they would be somewhat valuable to the web development community. The problem was that we didn[base ']t want this useful, time-sensitive information to sit around for days (or even weeks) waiting to be picked up by search bots and then found by people accidentally or when they were desperate for a solution.
So I proposed that we turned to Del.icio.us to expand our readership. Every time something went up on the site that I felt would be good enough for a wider audience, I added it to my Del.icio.us account with the appropriate tags and descriptions. Our goal was to try and get a feature on del.icio.us/popular by the end of July and to our surprise, we accomplished it in less than a week. After two weeks of diligent posting and tagging, Google gave us a little over 50 referrals while Del.icio.us gave us over 700.
I think the reason Del.icio.us is so successful at bringing the appropriate audience to good material is because they track the changing web by using people to calculate what is essentially [OE]page rank.[base '] They get access to decent fuzzy logic for a fraction of the cost and the democracy of the system allows anyone to get their idea of what deserves face-time into the system almost immediately.[per thou] [particletree, via Dave Farber[base ']s Interesting People mailing list]

Kevin Hale makes some really interesting observations in this essay, so you should read the whole thing, especially if you don[base ']t understand the all of the hoopla about these sites.>Feedster and the like make Google seem slower.

Epson offers new pro, consumer inkjets

Tue, 10 May 2005 18:08:53 GMT

Epson enhanced its line of inkjet printers on Tuesday with new wide-format printers for professionals and a new printer aimed specifically at professional photographers and fine art photographers. The new printers use Epson's UltraChrome K3 inks, an eight-color ink system that Epson said provides "exhibit-quality" output on a wide selection of media. The new printers range in price from US$849 to $4,995. What's more, the company also introduced a new PictureMate printer designed for consumers looking for a "personal photo lab." [Macworld]